Meta has disclosed significant findings from its Muse AI bug bounty initiative, revealing that approximately $1.2 million has been awarded to researchers. Among these, a notable $300,000 was granted for identifying a critical security flaw prior to the official launch, which affected internal test systems.
Muse AI and Its Role
Muse is a sophisticated personal AI agent designed to integrate seamlessly with users’ email, calendar, and messaging services. Each user’s digital assistant operates on a dedicated virtual machine, ensuring personalized interaction and functionality.
Initially launched as a private bug bounty program in April, it opened to the public on September 8, according to Meta’s David Singleton. Out of over 630 submissions, 64 were deemed valid and consequently rewarded.
Significant Rewards and Key Vulnerabilities
The substantial $300,000 payout was awarded months before Muse’s release, during a phase of preliminary internal testing. The flaw allowed unauthorized access to sensitive conversations and tokens on pre-release virtual machines used by Meta employees.
David Singleton elaborated that an authentication oversight permitted external requests to impersonate trusted sources due to mismanaged proxy headers. This misconfiguration arose during a system migration, necessitating immediate corrective measures, including taking the service offline.
Further Findings and Security Enhancements
In another case, a $90,000 bounty was given for exploiting a vulnerability where a malicious webpage could trick Muse into executing unintended actions. Meta has since implemented advanced detection signals to prevent such occurrences.
Additional rewards included $90,000 for bypassing email redaction filters and $50,000 for an Android app issue that could expose credentials via a privileged web view.
Meta’s maximum reward for a valid report is $300,000, surpassing many competitors in the AI sector. Smaller scale exploits affecting individual users can fetch up to $130,000, with fleetwide compromises earning up to $250,000.
These efforts underscore Meta’s commitment to maintaining robust security standards while engaging the global cybersecurity community in safeguarding its AI technologies.
